Backdoor attacks and defenses in feature-partitioned collaborative learning

By Yang Liu, Zhi-qian Yi, Tianjian Chen. 2020

64 citations recorded by the source corpus.

Since there are multiple parties in collaborative learning, malicious parties might manipulate the learning process for their own purposes through backdoor attacks. However, most of existing works only consider the federated learning scenario where data are partitioned by samples. The feature-partitioned learning can be another important scenario since in many real world applications, features are often distributed across different parties. Attacks and defenses in such scenario are especially challenging when the attackers have no labels and the defenders are not able to access the data and model parameters of other participants. In this paper, we show that even parties with no access to labels can successfully inject backdoor attacks, achieving high accuracy on both main and backdoor tasks. Next, we introduce several defense techniques, demonstrating that the backdoor can be successfully blocked by a combination of these techniques without hurting main task accuracy. To the best of our knowledge, this is the first systematical study to deal with backdoor attacks in the feature-partitioned collaborative learning framework.

Subfields: Artificial Intelligence, Federated & Distributed Learning, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Qiang Yang
2. Bo Li
3. Yang Liu
4. Dacheng Tao
5. Dawn Song
6. Murali Annavaram
7. Tom Goldstein
8. Quoc V. Le

In Federated & Distributed Learning

1. Qiang Yang
2. Murali Annavaram
3. Chaoyang He
4. Yang Liu
5. Praneeth Vepakomma
6. S. Avestimehr
7. Abhishek Singh
8. Yan Kang

In Privacy & Security

1. Qiang Yang
2. Yan Kang
3. Ramesh Raskar
4. Praneeth Vepakomma
5. Chaoyang He
6. Yang Liu
7. Murali Annavaram
8. Abhishek Singh

Citations in the corpus

• FedML: A Research Library and Benchmark for Federated Machine Learning (2020, positive): “As illustrated in Figure 4(c), VFL is the process of aggregating different features and computing the training loss and gradients in a privacy-preserving manner to build a model with data from all parties collaboratively [121, 35, 122, 123].”
• Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses (2020, background): “For example, [118] investigates backdoor attacks for feature-partitioned federated learning, where each participant only has access to a subset of features, and most of them do not have access to labels.”
• Vertical Federated Learning: Concepts, Advances, and Challenges (2022, background): “In [128], the authors show that gradient-replacement backdoor attacks can still survive in HE-protected VFL protocols.”
• Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challenges (2022, background): “[44] show that even attackers with no access to training labels can inject backdoor attacks in feature-partitioned collaborative learning.”
• Backdoor Learning: A Survey (2020, background): “The backdoor attacks towards meta federated learning [38] and featurepartitioned collaborative learning [39] were also discussed.”
• Heterogeneous Federated Learning: State-of-the-art and Research Challenges (2023, background): “Attack methods [62, 136, 203, 241] in federated learning settings should be studied to improve the attack robustness of federated systems.”